CVSS: 10.0EPSS: 4%CPEs: 12EXPL: 0CVE-2015-8812 – kernel: CXGB3: Logic bug in return code handling prematurely frees key structures causing Use after free or kernel panic.
https://notcve.org/view.php?id=CVE-2015-8812
drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets. drivers/infiniband/hw/cxgb3/iwch_cm.c en el Kernel de Linux en versiones anteriores a 4.5 no identifica correctamente condiciones de error, lo que permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (uso después de liberación de memoria) a través de paquetes manipulados. A use-after-free flaw was found in the CXGB3 kernel driver when the network was considered to be congested. The kernel incorrectly misinterpreted the congestion as an error condition and incorrectly freed or cleaned up the socket buffer (skb). When the device then sent the skb's queued data, these structures were referenced. A local attacker could use this flaw to panic the system (denial of service) or, with a local account, escalate their privileges. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.html http://lists.opensuse.org • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8830 – kernel: AIO write triggers integer overflow in some protocols
https://notcve.org/view.php?id=CVE-2015-8830
Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression. Desbordamiento de entero en la función aio_setup_single_vector en fs/aio.c en el kernel de Linux 4.0 permite a usuarios locales provocar una denegación de servicio o posiblemente tener otro impacto no especificado a través de un iovec AIO grande. NOTA: esta vulnerabilidad existe debido a una regresión de CVE-2012-6701. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c185ce06dca14f5cea192f5a2c981ef50663f2b http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c4f4b82694fe48b02f7a881a1797131a6dad1364 http://www.debian.org/security/2016/dsa-3503 http://www.openwall.com/lists/oss-security/2016/03/02/9 http://www.ubuntu.com/usn/USN-2968-1 http://www.ubuntu.com/usn/USN-2968-2 http://www.ubuntu.com/usn/USN-2969-1 http://www.ubuntu.com/usn/USN- • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2544
https://notcve.org/view.php?id=CVE-2016-2544
Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1 allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call at a certain time. Condición de carrera en la función queue_delete en sound/core/seq/seq_queue.c en el kernel de Linux en versiones anteriores a 4.4.1 permite a usuarios locales causar una denegación de servicio (uso después de liberación de memoria y caída del sistema) al realizar una llamada ioctl en un momento determinado. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3567eb6af614dac436c4b16a8d426f9faed639b3 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html http://www.debian.org/security/2016/dsa-3503 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1 http://www.openwall.com/lists/oss-security/2016/ • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2548
https://notcve.org/view.php?id=CVE-2016-2548
sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action, which allows local users to cause a denial of service (system crash) via a crafted ioctl call, related to the (1) snd_timer_close and (2) _snd_timer_stop functions. sound/core/timer.c en el kernel de Linux en versiones anteriores a 4.4.1 conserva ciertas listas enlazadas después de una acción de cierre o parada, lo que permite a usuarios locales causar una denegación de servicio (caída del sistema) a través de una llamada ioctl manipulada, relacionada con las funciones (1) snd_timer_close y (2) _snd_timer_stop. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b5a663aa426f4884c71cd8580adae73f33570f0d http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html http://www.debian.org/security/2016/dsa-3503 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1 http://www.openwall.com/lists/oss-security/2016/ • CWE-20: Improper Input Validation •
CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 0CVE-2016-2069 – kernel: race condition in the TLB flush logic
https://notcve.org/view.php?id=CVE-2016-2069
Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU. Condición de carrera en arch/x86/mm/tlb.c en el kernel de Linux en versiones anteriores a 4.4.1 permite a usuarios locales obtener privilegios desencadenando el acceso a una estructura de paginación por un CPU diferente. A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (for example, a page table). • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=71b3c126e61177eb693423f2e18a1914205b165e http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html http://rhn.redhat.com/errata/RHSA-2016-2574.html http://rhn.redhat.com/errata/RHSA-2016-258 • CWE-266: Incorrect Privilege Assignment CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •